jre17-zulu-bin

LOW
maintainer puddings233 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu OpenJDK; despite the static analyzer flagging the host as non-standard, this is a trusted vendor distribution, and the downloads are verified via fixed SHA256 checksums, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu OpenJDK; despite the static analyzer flagging the host as non-standard, this is a trusted vendor distribution, and the downloads are verified via fixed SHA256 checksums, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:44 "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: puddings233 <puddings233 at outlook dot com>
2
3_majorver=17
4_minorver=0
5_securityver=20.1
6_updatever=1
7_zulu_build="68.203"
8pkgname=jre${_majorver}-zulu-bin
9pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}
10pkgrel=2
11pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.'
12arch=('aarch64' 'i686' 'x86_64')
13url='https://www.azul.com/downloads/'
14license=('custom')
15depends=(
16 "java-runtime-common>=3"
17 "ca-certificates-utils"
18 "freetype2"
19 "glibc"
20 "harfbuzz"
21 "lcms2"
22 "libgcc"
23 "libjpeg-turbo"
24 "libnet"
25 "libstdc++"
26 "nss"
27 "giflib"
28 "libpng"
29)
30optdepends=(
31 'alsa-lib: for basic sound support'
32 'gtk3: for the Gtk+ 3 look and feel - desktop usage'
33)
34provides=(
35 "java-runtime=${_majorver}"
36 "java-runtime-openjdk=${_majorver}"
37 "jre${_majorver}-openjdk=${pkgver}-${pkgrel}"
38 "java-runtime-headless=${_majorver}"
39 "java-runtime-headless-openjdk=${_majorver}"
40 "jre${_majorver}-openjdk-headless=${pkgver}-${pkgrel}"
41)
42install="$pkgname.install"
43source_aarch64=(
44 "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"
45 "freedesktop-java.desktop"
46)
47source_i686=(
48 "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_i686.tar.gz"
49 "freedesktop-java.desktop"
50)
51source_x86_64=(
52 "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_x64.tar.gz"
53 "freedesktop-java.desktop"
54)
55sha256sums_aarch64=(
56 '12e8a6a0957c38bcb16b0d18187ba60dfe88e9d16dd99e5eefd5929d1b132931'
57 '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
58)
59sha256sums_i686=(
60 'acda3a3a691df809f7b14b002b7a0db89f9a5733a537ac303fc88568ccb5a4ed'
61 '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
62)
63sha256sums_x86_64=(
64 'ab4f4e4bee5db1a266ba08134cd93275ca394c025afde58e6cd34f6aee8d6eb9'
65 '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
66)
67
68_jvmdir=/usr/lib/jvm/java-${_majorver}-zulu
69
70case "${CARCH}" in
71 aarch64) _JARCH='aarch64';;
72 i686) _JARCH='i686';;
73 x86_64) _JARCH='x64';;
74esac
75
76package() {
77
78 cd "$srcdir/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_${_JARCH}"
79
80 install -dm 755 "${pkgdir}${_jvmdir}"
81
82 cp -a bin lib \
83 "${pkgdir}${_jvmdir}"
84
85 # Conf
86 install -dm 755 "${pkgdir}/etc"
87 cp -r conf "${pkgdir}/etc/java${_majorver}-zulu"
88 ln -s "/etc/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/conf"
89
90 # Legal
91 install -dm 755 "${pkgdir}/usr/share/licenses"
92 cp -r legal "${pkgdir}/usr/share/licenses/java${_majorver}-zulu"
93 cp DISCLAIMER "${pkgdir}/usr/share/licenses/java${_majorver}-zulu/"
94 ln -s "/usr/share/licenses/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/legal"
95
96 # Link JKS keystore from ca-certificates-utils
97 rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
98 ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
99
100 # Desktop files
101 install -Dm 644 \
102 "${srcdir}/freedesktop-java.desktop" \
103 "${pkgdir}/usr/share/applications/java-java${_majorver}-zulu.desktop"
104}
105
106# vim: ts=2 sw=2 et:
107

Changes since previous scan

--- PKGBUILD @ 2026-09-02 00:02
+++ PKGBUILD @ 2026-09-17 00:27
@@ -2,12 +2,12 @@
_majorver=17
_minorver=0
-_securityver=20
-_updatever=8
-_zulu_build="68.17"
+_securityver=20.1
+_updatever=1
+_zulu_build="68.203"
pkgname=jre${_majorver}-zulu-bin
-pkgver=${_majorver}.${_minorver}.${_securityver}.u${_updatever}
-pkgrel=1
+pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}
+pkgrel=2
pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.'
arch=('aarch64' 'i686' 'x86_64')
url='https://www.azul.com/downloads/'
@@ -53,15 +53,15 @@
"freedesktop-java.desktop"
)
sha256sums_aarch64=(
- 'dc2004d03e7a8dc82940a35433f1337303dafdbd34a06a030ce957ba38bb3a8a'
+ '12e8a6a0957c38bcb16b0d18187ba60dfe88e9d16dd99e5eefd5929d1b132931'
'4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
)
sha256sums_i686=(
- '946b02fe10d6b9832aac69a7ec6670574b4c6e5c9d2e87b9b16c334922981260'
+ 'acda3a3a691df809f7b14b002b7a0db89f9a5733a537ac303fc88568ccb5a4ed'
'4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
)
sha256sums_x86_64=(
- '96c6a5cbc4d0c582bb126d41e280b254db0332a93ed37ae2219debfbe4d3e73f'
+ 'ab4f4e4bee5db1a266ba08134cd93275ca394c025afde58e6cd34f6aee8d6eb9'
'4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
)
@@ -96,6 +96,11 @@
# Link JKS keystore from ca-certificates-utils
rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
+
+ # Desktop files
+ install -Dm 644 \
+ "${srcdir}/freedesktop-java.desktop" \
+ "${pkgdir}/usr/share/applications/java-java${_majorver}-zulu.desktop"
}
# vim: ts=2 sw=2 et:

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 13:50:58 Medium 1
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion